Mystery Box

Summary

The delete operation used in the transferReward, claimAllRewards, and claimSingleReward functions does not reduce the size of the array, potentially leading to logical issues and inefficiencies.

Vulnerability Details

The contract uses delete to remove elements from the rewardsOwned array. However, this does not reduce the array's length, leaving "empty slots" that could cause issues when the contract logic assumes the array length reflects the number of valid entries.

Impact

These empty slots could lead to logical errors, particularly in functions that iterate through the array. This could result in faulty reward transfers or claims.

Tools Used

Manual Code Review

Recommendations

Instead of using delete, consider shifting array elements after an item is removed to maintain a contiguous array. Alternatively, use a more sophisticated data structure like a mapping for rewards.